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Blind quantum computation is a novel secure quantum computing protocol 
which enables Alice, who does not have sufficient quantum technology at her 
disposal, to delegate her quantum computation to Bob, who has a fully-fledged 
quantum computer in such a way that Bob cannot learn anything about Alice's 
input, output, and algorithm. A recent proof-of-principle experiment demon- 
strating blind quantum computation in an optical system has raised new chal- 
lenges regarding the scalability of blind quantum computation in realistic noisy 
conditions. Here we show that fault-tolerant blind quantum computation is 
possible in a topologically-protected manner using the Raussendorf-Harrington- 
Goyal scheme. The error threshold of our scheme is 4.3 x 10^^, which is com- 
parable that (7.5 X 10 of non-blind topological quantum computation. Since 
the error per gate of the order 10 was already achieved in some experimental 
systems, our result implies that secure cloud quantum computation is within 
reach. 

In classical computing, the problem of ensuring the communication between a server and 
a client in secure is highly non-trivial. For example, Abadi, Feigenbaum and Killian showed 
that no NP-hard function can be computed with encrypted data if unconditional security 
is required, unless the polynomial hierarchy collapses at the third level [l|. Even restricting 
the security condition to be only computational, the question of the possibility of the fuUy- 
homomorphic encryption has been a long-standing open question for 30 years {2], and still 
no practical method has been found. Unconditionally secure fuUy-homomorphic encryption 
is still an open problem. 

On the other hand, in the quantum world, the situation is drastically different. Broad- 
bent, Fitzsimons and Kashefi proposed a quantum protocol [3], so-called blind quantum 
computation , which uses measurement-based quantum computation (MBQC) j9|. In 
their protocol, Alice has a classical computer and a quantum device that emits randomly- 
rotated qubits. She does not have any quantum memory. On the other hand. Bob has a 
fully-fledged quantum technology. Alice and Bob share a classical channel and a quantum 
channel. Their protocol runs as follows. First, Alice sends Bob many randomly- rotated 
qubits, and Bob creates a graph state by applying CZ gates among these qubits. Second, 
Alice instructs Bob how to measure a qubit of the graph state. Third, Bob measures the 
qubit according to Alice's instruction, and he returns the measurement result to Alice. They 
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repeat this classical two-way communication (i.e., the second and third steps) until the com- 
putation is finished. It was shown [3] that if Bob is honest, Alice can obtain the correct 
answer of her desired quantum computation (correctness) , and that whatever evil Bob does, 
he cannot learn anything about Alice's input, output, and algorithm (blindness) . Recently, 



this protocol has been experimentally demonstrated in an optical system 

Secure delegated computation is already in the practical phase for classical computing, 
including smart phones, encrypted data retrieval [lO|, and wireless sensor networks 
When scalable quantum computers are realized, the need for delegated secure computation 
must be emphasized, since home-based quantum computers are arguably much more difficult 
to build than their classical counterparts. In order to implement blind quantum computa- 
tion in a scalable manner, it is crucial to protect quantum computation from environmental 
noise. In this paper, we show that a fault-tolerant blind quantum computation is possible 
in a topologically protected manner. We also calculate the error threshold, 4.3 x 10~^, for 
erroneous preparation of the initial states, erroneous CZ gates, and erroneous local mea- 
surements. This is the first time that a concrete fault-tolerant scheme is proposed for blind 
quantum computation, and that the error threshold is explicitly calculated. Furthermore, 
this threshold is not so different from that, 7.5 x 10^'^, of non-blind topological quantum 
computation [12I, Q- In other words, blind quantum computation is possible with almost 
the same error threshold as that of the non-blind version. Since the error threshold of the 



order 10~^ was already achieved in some experimental systems 1^, our result means that 
secure cloud quantum computation is within our reach. We further show that our protocol 
is also fault-tolerant against the detectable qubit loss, such as a photon loss and an escape 
from the qubit energy level. 

I. RESULTS 



A. Topologically-protected MBQC 

The topologically-protected measurement-based quantum computation (TMBQC) 
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15| is one of the most promising models of quantum computation. In this model, we first 
prepare the graph state on the three-dimensional cubic lattice C whose elementary cell is 
given in Fig. [1] (a). We call this lattice £ the Raussendorf-Harrington-Goyal (RHG) lattice. 
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We next measure each qubit of this lattice in X , Z , T = (X + Y)/ \/2, or Y basis. These 



four types of measurements are sufficient for the universal TMBQC as is shown in Refs. 



12 



13| . (More precisely, measurements in X basis and Z basis can simulate the topological 



braidings of defects in the surface code 



16| which can implement the fault-tolerant Clifford 



gates, and measurements in T basis and Y basis can simulate the preparations of magic 



states 



171] which can implement the non-Clifford gates. These magic states are distilled 17 1 



by topologically protected fault-tolerant Clifford gates which are simulated by X and Z 
basis measurements.) A small-size TMBQC has recently been experimentally demonstrated 



in an optical system 



15|- 



B. Blind TMBQC 

Can we use TMBQC for the blind quantum computation? Obviously, if Bob knows in 
which basis {X, Z, T, or Y) he is doing the measurement on each qubit, he can know Alice's 
algorithm. However, if Alice can have Bob do measurements in such a way that Bob cannot 
know in which basis (X, Z, T, or Y) he is doing the measurement on each qubit, he cannot 
know Alice's algorithm. How can Alice do that? In fact, such a blind quantum computation 
is possible if we consider the three-dimensional lattice C whose elementary cell is given in 
Fig. [1] (b) where two extra qubits are added to each qubit of Fig. [1] (a). We call this lattice 
C the decorated RHG lattice. The intuitive explanation of our idea is as follows: First, 
it was shown 3[ that Alice can have Bob do the measurement in {|0) ± e*''^|l)} basis for 
any (p E \ k = 0,1,..., 7} on any qubit of a graph state which Bob has in such a way 
that Bob cannot learn anything about 0. Second, it is easy to confirm that a single-qubit 
measurement in X, Y, T, or Z basis can be simulated on the linear three-qubit cluster state 
with only {|0) ± e*'^|l)} basis measurements (Fig. [2]). By combining these two facts, we 
notice that if we decorate the RHG lattice as is shown in Fig. [1] (b). Bob can simulate the 
measurement in X, Y, T, and Z basis only with {|0) ± e*'^|l)} basis measurements, and he 
cannot know which type of measurements {X, Y, T, or Z) he is simulating. 

More precisely, our protocol runs as follows (Fig. [3]): 

Step 1. Alice sends N randomly-rotated single-qubit states {\Oj)}jLi to Bob through the 
quantum channel, where 

|^^,)^|0) + e^''^|l). 



and 9j E {^\k = 0,1,. ..,7} (j = 1,2, ...,A^) are random numbers. is the total number 
of qubits used in the decorated RHG lattice C. Alice remembers all random numbers 
6 = {9j}jLi, and they are kept secret to Bob. 

Step 2. Now Bob has {\9j)}f=i- He places \9j) on the jth vertex of the decorated RHG 
lattice C for all j (j = 1,...,A^). He then applies the CZ gate on each red edge of the 
decorated RHG lattice Let us denote thus created A^-qubit state by \Cq). Since 

N 

\Ce) = f(2)CZ,,)f(S?)e-^^^/^)|+)«^ 



k,l j=l 
N 



j=i k,i 

\Cq) is nothing but a rotated graph state on the decorated RHG lattice Here CZ^^i is 
the CZ gate between fcth and Ith qubits. 

Step 3. If Alice wants Bob to measure jth qubit of |Ce) in {|0) ± e*'^j|l)} basis, she 
calculates 

6j = (p'j + 9j + TjTi (mod 27r) 

on her classical computer. Here, rj G {0, 1} is a random number, = (—1)''^ (f)j + 7r'^j (mod 
2n), and sf,sf G {0,1} are determined by the previous measurement results (this is the 



). Then Alice sends 6j to Bob through the 



usual feed-forwarding in the one-way model 
classical channel. 

Step 4. Bob measures jth qubit in the {|0) ± 6**^^11)} basis, and returns the result of the 
measurement to Alice through the classical channel. 

Step 5. They repeat steps 3 and 4 with increasing j until they finish the computa- 
tion. Note that Alice does the classical processing for the error correction by using Bob's 
measurement results. 

C. Correctness 

Let us show that this protocol is correct. In other words, Alice and Bob can simulate 
the original TMBQC [3,(3 on the decorated RHG lattice C with only {|0) ± e^<^|l)} basis 
measurements if Bob is honest. Let us consider three qubits labeled with 1, 2, and 3, in 
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Fig. [T] (b). Let us assume that Bob measures these three qubits in the numerical order (i.e., 
from the bottom one to the top one) in the 



{|0) ie'-^^ ll)} = je-'^^^/'Z^fx^f (|0) ie^'^^ ll)) 



basis (j = 1,2,3) with (</)i, </)2, (/'s) = (0,0,0). By a straightforward calculation, it is easy 
to show that such a sequence of measurements on the three qubits is equivalent to the 
measurement in X basis on the qubit labeled with 1 in Fig. [1] (a) (also Fig. E] (a)). (Note 
that 6j in Bob's measurement basis is canceled since jth qubit is pre-rotated by 6j by 
Alice. Furthermore, r^vr causes just the flip of the measurement result. Therefore, Bob 
effectively does {|0) ± e*''^^ |l)} basis measurement although he is doing {|0) ± e*^j |l)} basis 
measurement.) In other words, our lattice C can simulate X basis measurements on C. In 
a similar way, if Bob does measurements on the three qubits labeled with 1, 2, and 3 in 
Fig. □ (b) in other angles, (0i, 02, ^s) = (0, 0, n/2), (0, 0, 7r/4), and (7r/2, tt/2, tt/2), they are 
equivalent to the Y, T, and Z basis measurements on the qubit labeled with 1 in Fig. [1] 
(a), respectively (Fig. [2] (b), (c), and (d)). In this way, our lattice C can simulate X, Z, 
T, and Y basis measurements on C. In short, we have shown that \Cq) on the decorated 



RHG lattice C can simulate the original TMBQC 12|, |l3| on the RHG lattice C solely with 
{|0) ± e*"^!!)} basis measurements. 



D. Blindness 



How about the blindness? In our protocol, what Alice sends to Bob are randomly rotated 
single-qubit states {\9j)}^^^ and measurement angles {5^}^]^. Without loss of generality, we 
can assume that the preparation of the input is included in the algorithm. Therefore, what 
Alice wants to hide are the algorithm and the output. We can show that the conditional 
probability distribution of Alice's computational angles, given all the classical information 
Bob can obtain during the protocol, and given the measurement results of any POVMs 
which Bob may perform on his system at any stage of the protocol, is equal to the a priori 
probability distribution of Alice's computational angles. We can also show that the final 
classical output is one-time padded to Bob. (For a proof, see Methods.) 
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E. Threshold 



Finally, let us calculate the fault-tolerant threshold. As in Refs. [l2|, [l3|, we assume that 
errors occur during the preparation of initial states {\9j)}jLi, the applications of CZ gates, 
and the local measurements. The erroneous preparation of an initial state is modeled by 
the perfect preparation followed by the partially depolarizing noise with the probability pp: 
(1 — pp)[I] + ^([AT] + [Y] + [Z]), where [•] indicates the super operator. The erroneous 
local measurement is modeled by the perfect local measurement preceded by the partially 
depolarizing noise with the probability pm- The erroneous CZ gate is modeled by the 
perfect CZ gate followed by the two-qubit partially depolarizing noise with the probability 
P2: (1 — P2)[I ® I] + ^{[I ® X] + ... + [Z (g) Z]). Because of the rotational symmetry of 
the depolarizing noise, we can replace [A] with [e~*^J^/^y4e*^^^/^] when it acts on the jth 
qubit, and [A (g) B] with [(e'^^^^^^Ae^^^^^^) (g) (e-^^fc^/^^e*^'^^/^)] when it acts on the jth 
and kth qubits. Here, A,B = I,X,Y or, Z. These replacements just correspond to the 
rotation of the local reference frame of each qubit. Then, if the measurement basis on 
the jth qubit (j = 1,...,A^) is rotated by e"*^^^/^, the factor (^^^^e~^^^^/^ is canceled. 
Therefore, when we calculate the fault-tolerant threshold of our protocol, we can assume 
that all 6j = without loss of generality. As in Ref. we assume that |Ce) is created in 
the stepwise manner (Fig. Hj). In our case, however, the additional fifth step is introduced 
as is shown in Fig. H] (e). First, let us calculate the single-qubit Z error probability Xj 
(j = 1,2,3) on each of the three qubits labeled with 1,2,3 in Fig. [1] (b) after creating 
\Cq). By a straightforward calculation, we obtain Ai = 32p2/15 + 8p2/15 + 2pp/3, X2 = 
I6P2/I5 + 2pp/3, and A3 = 8p2/l5 + 2pp/3 up to the first order of pp and p2. Once 
an erroneous |Ce) is created, we start local measurements. As is shown in Fig. [5], the 
three qubits are sequentially measured in numerical order. Such a sequential measurement 
propagates all pre-existing errors on qubits labeled with 1 and 2 to the qubit labeled with 
3. By a straightforward calculation, the accumulated error probability on the qubit labeled 
with 3 by such a propagation is Xtotai = Ai + A3 + 2 x 2pm/S for (0i, 02,03) = (0,0,0). 
(We have only to consider the measurement pattern which corresponds to the effective X 
measurement on the qubit labeled with 1 in Fig. [1] (a), because we are now interested in the 
topological error-correction of the bulk qubits.) The value Xtotai corresponds to the quantity 
qi, which was studied in Ref. ISj, of the qubit labeled with 1 in Fig. [T] (a). The correlated 
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two-qubit error probability [18| q2 = 4j92/15 + 0{pl) in our protocol is the same as that in 
Ref. [isl. If we assume pp = pm = = p, we obtain the bulk topological error threshold as 



p = 4.3 X 10"^ from Fig. 10 of Ref. 



18l | where the threshold curve of {qi,q2) is numerically 



calculated by using the minimum-weight-perfect-matching algorithm. 

The primal defects are created by measuring the edge qubits inside the defect region in the 
Z basis. At the boundary of the defect region (surface of the defects), these measurements 
introduce additional Z errors on the face qubits (i.e., dual qubits), which has an effect of 
decreasing the threshold value. At the same time, the existence of the defects changes the 
boundary condition of the bulk region; at the surface of the primal defects, the dual lattice 
has a smooth boundary. Thus, there is excess syndrome available at the defect surface, which 
has an effect of increasing the threshold value. In Ref. [l^, they have performed numerical 
simulation for lattices of size L x L x 2L, where half of the lattice belongs to the bulk region 
V and the other half to the defect region D. In their calculations, the error probability 
of the dual qubits of the surface of the defect is doubled to investigate the surface effect. 
Their numerical result indicates that while the surface effect due to the smooth boundary 
(i.e., increasing the threshold value) is noticeable, the intersection point of fidelity curves 
is slowly converging to the threshold value of the bulk region in the increasing number of 
the lattice size. This indicates that the Z basis measurements for the defect creations do 
not lower the threshold for TMBQC. In the present case, the error probability of Z basis 
measurement is increased by Xz = 2(2pm/3) + 2(2pp/3) + p2 due to the additional qubits 
for the blind Z basis measurement. However, when pm = Pp = P2 = 4.3 x 10^^, the error 
probability Xz = 1.6 x 10^^ is still smaller than the situation that has been considered in 
Ref. jisl. Thus the defect creations do not lower the threshold in the blind setup again, and 
hence the threshold value is determined by that for the bulk region. 

Topological error correction breaks down near the singular qubits, and it results in an 
effective error on the singular qubits 12, ll3| . This effective error is local because singular 
qubits are well separated from each other. Magic state distillation 171] can tolerate a rather 
large amount of noise, and therefore the overall threshold is determined by that for the 
bulk topological region [l^, 1^. In fact, the recursion relations of the distillations of Y and 
{X + Y)/V2 = T basis states are given by e^^ = 7{eYf + ej^ and e^^ = 35{eff + e^^, 
where e^^ and e^^ indicate the probability of errors introduced by the Clifford gates for the 
magic state distillation [l3|. In order to optimize their overheads, the scale factor and defect 
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thickness at each distillation level are chosen so that ' and e^^ are balanced. Since and 
ej^p can be reduced rapidly by increasing the scale factor and the thickness of the defect, 
the threshold values for the magic state distillation can be determined as = 0.38 and 

= 0.17 for Y- and T-state distillations, respectively. In the present decorated case, the 
error probability of the injected magic state is at most e = 4^2 + 2p2 + 3(2pjv//3) + 3(2pp/3), 
where the first, second, third, and forth terms indicate four CZ gates for generating RHG 
lattice, two CZ gates for the decoration, three measurements, and three state preparations. 
With pm = Pp = P2 = 4.3 x 10^'^, e = 10p2 = 0.043 which is sufficiently smaller than the 
threshold values for the magic state distillations. 

In the above arguments, we have assumed pp = pm = p2 for simplicity. However, pp 
might be much larger than pm and p2, since Alice's quantum technology is assumed to be 
much weaker than that of Bob, and the randomly-rotated qubits are sent from Alice to Bob 
through a probably noisy quantum channel. (In addition, Alice cannot distill her qubits, 
since she cannot use any two-qubit gate.) Hence let us consider another representative 
scenario, pp = lOp, pm = P2 = P- Interestingly, the direct calculation shows that the error 
threshold is p = 1.6 x 10^^ (i.e., still of the order of 10"'^). This suggests the nice robustness 
on Alice's side in the topological fault-tolerant protocol. (Note that this result is reasonable 
because the preparation error behaves as an independent error, and independent errors are 
known to be easy to correct. In fact, if there is no correlated error, TMBQC can tolerates 
the independent error up to 2.9%.) 



II. DISCUSSION 



In addition to the probabilistic depolarizing noise, which we have considered, there are 
many possibilities of errors. For example, quantum computation can suffer from the de- 
tectable qubit loss, such as photon loss, atoms or ions escaping from traps, or, more gen- 
erally, the leakage of a qubit out of the computational basis in a multilevel system. In 
Ref. 19|, the threshold of the TMBQC for the qubit loss was studied. Here let us briefly 



explain that we can obtain a similar threshold for the qubit loss in our blind protocol. As in 



Ref. 



19|, let us assume that losses are independent and identically distributed events with 



the probability pioss- If one of the three qubits labeled with 1, 2, and 3 in Fig. [T] (b) is 
lost, then we just consider the entire three-qubit chain is lost. Then, we can use the result 
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of Ref. 



19| , and our threshold for the qubit loss is obtained by replacing their pioss with 



19i, then the overhead is 



loss) ' ! which is still independent of the size of the algorithm and hence ensuring 



Spioss- Note that if we also use the post-selected scheme of Ref. 
~ (1 - 3p; ^"^^ 

scalab ility . Another possible error, the non-determinism of CZ gates, was considered in 
Refs. 
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2l| for TMBQC. For example, in Ref. [20i], the three-dimensional resource state 



is created by fusing the "puffer ball" states. If the one-dimensional chain of two qubits is 
added to the root qubit of each puffer ball state, |Ce) can be created by a similar fusion 
strategy, and the threshold can also be calculated in a similar way. 

Although the simulation of fault-tolerant quantum circuits in the blind MBQC on the 
brickwork state was mentioned in Ref. jj], it is only the existence proof. Neither a concrete 
scheme nor an explicit calculation of the threshold was given. Furthermore, on the two- 
dimensional brickwork state, we should use the fault-tolerant scheme of the one-dimensional 
nearest-neighbour circuit model architecture. For the circuit model, the threshold of this 



scheme is of the order of 10 
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23(1 . If we irnplement this scheme on MBQC, the threshold 



should be ~ 10~^ due to the extra qubits [2J, l25|. As is mentioned in Ref. [3[, the threshold 
should be increased if the three-dimensional brickwork state is considered. However, the 
explicit calculation of the threshold for the scheme of Ref. 
smaller than that of TMBQC. 

In the protocol, Alice performs the decoding operation (error correction) by using the 



261] is not known and should be 



classical data from Bob 



12 



13| . We have calculated the threshold value for the present blind 



protocol by following the result in Ref. [18[, where the minimum- weight-perfect-matching 
algorithm is used for the decoding problem. Although the minimum-weight-perfect-matching 
is an efficient algorithm in the sense that it scales polynomially, it might cost large classical 
computational resources when the lattice size is large. However, more efficient classical 
algorithms for the decoding problem have also been developed 



27 



29| . one of which [2 



achieves the decoding of the lattice of 4 million qubits within a few seconds by using a 
today's typical classical computer, while the resultant threshold 0.9% is higher than that 
0.75% in Ref. [l8|. In this sense, Alice's classical processing does not present any problem 
here. 
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III. METHODS 



A. Definition of the blindness 



Here we show the bhndness of our protocol. Intuitively, a protocol is blind if Bob, given 
all the classical and quantum information duringthe protocol, cannot learn anything about 



Mice. co.p„ta«o„al angles, .p. and o.p.li fll A ...al de«n..on we adop. .e.e 
is as follows. (See also Refs. js, 5, 6|.) 

A protocol is blind if: (Bl) the conditional probability distribution of Alice's computa- 
tional angles, given all the classical information Bob can obtain during the protocol, and 
given the measurement results of any POVMs which Bob may perform on his system at any 
stage of the protocol, is equal to the a priori probability distribution of Alice's computational 
angles; and (B2) the final classical output is one-time padded to Bob. 



B. Our protocol satisfies Bl 

Let us define A = (Ai,...,A^), $ = ($1, $jv), 6 = (0i,...,e^), R = {Ri,...,Rn), 
where Aj,6j,$j E A = {^\k = 0,1,. ..,7} and Rj E {0,1} are random variables, corre- 
sponding to the angles sent by Alice to Bob, random prerotations, Alice's secret compu- 
tational angles, and the hidden binary parameters, respectively. From the construction of 
the protocol, the relation A^ = $j + 6^ + Rjir (mod 2n) is satisfied. Let {Ilj}JLi be a 
POVM which Bob may perform on his {\6j)} jLi- Let O E {1, m} be the random variable 
corresponding to the result of the POVM. Bob's knowledge about Alice's computational 
angles is given by the conditional probability distribution of $ = (0i, ...,(Pn) given O = j 
and A = {6i,...,6n): P($ = (0i, 0iv)|O = j, A = {61, ...,6n)). 
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Prom B ayes' theorem, we have 



P = (01, 0,v) |0 = J, A = {Si, Sn)) 

P(0 = J 1$ = (01, 0Ar), A = (5i, 5Ar))p($ = (01, 0Ar), A = (5i, 5^)) 



p(0 = j,A=(5i,...,5iv)) 



p(o = j 


(0l,...,0jv),A = (5i,...,(5Ar)^ 


p($ = (0i,...,0^))p(A = (5i,...,5^r)) 


p(o = j 


A = (<5i,...,5;v)) 


p(a = (5i,...,5^)] 





P $ = (01,...,0A,) 



Tr 



Ilj (g)^^i i X)ii=o -(Pi- ri-K){Si -(pi- rj7r|] 



Tr 



= p($ = (0i,...,0^)). 

C. Our protocol satisfies B2 

It is easy to confirm that when Bob measures the qubit labeled with 3 in Fig. 1 (b) , the 
state is one-time padded with Z^'^X^'^, where Si (52) is the measurement result of the qubit 
labeled with 1 (2) in Fig. 1 (b). The values of si and S2 are unknown to Bob, since {rjj^^i 
are unknown to Bob. We can show that {rjjjL^ are unknown to Bob as follows. 

P(P = (n, r^) \0 = j,A = {Si, Sn)) 

P(0 = J |P = (n, tat), A = {Si, Sn))p(r = (ri, r^v), A = {Si, Sn)) 



p(o^j,A^{Si,...,SN)) 



p(o = j 


R= {ri,...,rN),A = {Si,...,SN))p[R = 


{ri,...,rr,))p[A = {Si,...,SN)) 




a^{Si,...,Sm))p(a 


= {Si, ...,5jv)) 



P(p = (ri,...,riv)) 
P(p=(ri,...,r^)) 



Tr 


Hi (8)ili 1 E<^,e^ -4>i- riTi){Si -(pi- riTi\ 




Tr 







1 

2^' 
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(a) (b) 

FIG. 1: Elementary cells, (a): The elementary cell of the RHG lattice £. (b): The elementary 
cell of the decorated RHG lattice 



15 




FIG. 2: How the decorated lattice works. If we prepare the three-qubit cluster state and 
measure each qubit in the numerical order in the {|0) it basis with {(f>i,(j)2,4>3) = (0)0)0)) 

(0,0, 7r/2), (0,0, 7r/4), and (7r/2, 7r/2, 7r/2), we can simulate single-qubit measurements in X, Y, T, 
and Z basis, respectively. Each corresponds to (a), (b), (c), and (d). 
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FIG. 3: Topological blind protocol, (a) Alice sends Bob randomly rotated qubits. (b) 
Bob creates the decorated RHG lattice, (c) Alice sends Bob a classical message, (d) Bob does 
the measurement and returns the result to Alice, (e) Alice can hide her topological quantum 
computation from Bob. 
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FIG. 4: The stepwise creation of the resource state. |Ce) is created from (a) to (e). 




FIG. 5: The measuring pattern. Three qubits are measured in the numerical order from (a) 
to (c). 
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